>Not on some random thing the application does (like authentication, CSRF or sending CORS headers). Sending CORS headers isn't "some random thing" though, it's

>Not on some random thing the application does (like authentication, CSRF or sending CORS headers). Sending CORS headers isn't "some random thing" though, it's specifically the one thing that stops the security model that's in place from working. There's a lot of bad security practices that you could define as "some random thing", and the fact that some people might do that thing doesn't make the whole model around it invalid.